ship, review, land-and-deploy, landing-report: fix stale cross-references (s06 H1, s06 H2, s06 H3, s06 H4, s06 H5, s06 H8, s06 M6)

- H1: TODOS-format cites /ship Step 14, not 5.5.
- H2: the land readiness review is the checklist /ship applies in Step 9 (there
  is no Step 3.5).
- H3: the Apple adapter names the no-credential-talk rule by location instead
  of 'line 14' (it renders at line 16).
- H4: greptile triage diffs against origin/<base> from the caller's detected
  base, not origin/main.
- H5: the land Important Rules recap matches the steps (4-minute CI rounds in
  Step 3; 30 seconds for merge readback and deploy status).
- H8: landing-report calls the util once per bump level (four), and drops the
  unsupported 'cached by bun' claim.
- M6: landing-report says what its base detection does instead of claiming
  it matches other skills.
No test pins the removed text. expected red until the regeneration commit

land-and-deploy/SKILL.md.tmpl

@@ -495,7 +495,7 @@ Recheck read-only evidence; never redo a merge/deploy because a section was miss
 
 - Never force-push, bypass CI, replay a confirmed merge, or hide missing evidence.
 - Auto-detect facts; ask when unknown or when an explicit approval gate applies.
-- Poll at 30-second intervals with the stated deadlines and progress messages.
+- Poll at each step's stated interval and deadline (4-minute CI rounds in Step 3; 30 seconds for merge readback and deploy status), with its progress messages.
 - After merge failures, offer approved rollback when appropriate; never revert a rollback automatically.
 - Verify once; `/canary` provides extended monitoring. Rechecks require the user's choice.
 - Use `--delete-branch`; reconcile failed cleanup non-destructively with confirmation.

land-and-deploy/sections/readiness-gate.md.tmpl

@@ -79,8 +79,8 @@ Read the review checklist:
 ```bash
 cat ~/.claude/skills/gstack/review/checklist.md 2>/dev/null || echo "Checklist not found"
 ```
-Apply each checklist item to the current diff. This is the same quick review that `/ship`
-runs in its Step 3.5. Auto-fix trivial issues (whitespace, imports). For critical findings
+Apply each checklist item to the current diff. This is the same checklist `/ship`
+applies in its Step 9 review. Auto-fix trivial issues (whitespace, imports). For critical findings
 (SQL safety, race conditions, security), ask the user.
 
 **If any code changes are made during the quick review:** Commit the fixes, then **STOP**.

landing-report/SKILL.md.tmpl

@@ -38,7 +38,7 @@ Think of it as `gh pr list` for VERSION numbers.
 
 ## Step 1: Detect platform and base branch
 
-Same detection as other gstack skills.
+Use the current PR's base branch, else the repository's default branch, else `main`.
 
 ```bash
 BASE_BRANCH=$(gh pr view --json baseRefName -q .baseRefName 2>/dev/null || \
@@ -63,8 +63,8 @@ echo "branch HEAD VERSION: $CURRENT_VERSION"
 
 ## Step 3: Query the queue
 
-Call the util three times — once for each bump level — so the user sees what
-they'd claim for micro/patch/minor/major. Cheap (same gh call cached by bun).
+Call the util once per bump level (micro, patch, minor, major) so the user sees
+what each level would claim.
 
 ```bash
 for LEVEL in micro patch minor major; do

review/TODOS-format.md

@@ -1,6 +1,6 @@
 # TODOS.md Format Reference
 
-Shared reference for the canonical TODOS.md format. Referenced by `/ship` (Step 5.5) and `/plan-ceo-review` (TODOS.md updates section) to ensure consistent TODO item structure.
+Shared reference for the canonical TODOS.md format. Referenced by `/ship` (Step 14) and `/plan-ceo-review` (TODOS.md updates section) to ensure consistent TODO item structure.
 
 ---
 

review/greptile-triage.md

@@ -83,7 +83,7 @@ For each non-suppressed comment:
 
 1. **Line-level comments:** Read the file at the indicated `path:line` and surrounding context (±10 lines)
 2. **Top-level comments:** Read the full comment body
-3. Cross-reference the comment against the full diff (`git diff origin/main`) and the review checklist
+3. Cross-reference the comment against the full diff (`git diff origin/<base>`, using the base branch the calling skill detected) and the review checklist
 4. Classify:
    - **VALID & ACTIONABLE** — a real bug, race condition, security issue, or correctness problem that exists in the current code
    - **VALID BUT ALREADY FIXED** — a real issue that was addressed in a subsequent commit on the branch. Identify the fixing commit SHA.

ship/sections/apple-release.md.tmpl

@@ -93,4 +93,4 @@ Build this question's options from a LIVE check of installed skills at ask time
 
 `produce` already created the app record and bundle ID during the run — never call the app record a manual gate. Apply the pricing settled in the authorization moment through the App Store Connect price-schedule endpoint (`POST /v1/appPriceSchedules` via the session or the minted key): fastlane's `price_tier` option is broken against the current API ("'prices' is not a relationship on 'apps'"), so never route pricing through it or call its failure an account problem. `deliver` owns everything else the store listing needs: description, keywords, localizations, screenshot upload per device size, attaching the uploaded build, and Submit for Review; `pilot` manages TestFlight groups and testers as an intermediate round when the user asked for one. Submission follows the same durable-effect contract with key `appstore.submit.<bundle-id>.<version>` — on ambiguity, inspect App Store Connect before re-running. Monitor review status from the CLI afterward.
 
-What remains web-only, ever: the paid Apple Developer Program membership purchase itself (a precondition, not a release step) and, for PAID apps only, the one-time Paid Apps agreement with banking and tax — offer the agentic-browser drive per the Third-Party Web Actions contract (earlier in this skill) before any manual checklist for those. A free app needs no browser at any point. After submission, report that App Review typically answers within a day or two and close the run; review outcome is not a gate this workflow can hold open. In that SAME closing report, disclose the durable credential the release created — one line, once per run: "This created an App Store Connect API key (`gstack-upload`, scoped to this app) that persists for future releases; revoke it anytime at App Store Connect → Users and Access → Integrations, or delete `~/.gstack/apple/api-key.json` locally." This is the deliberate exception to the mid-run no-credential-talk rule (line 14): the user is otherwise never told a standing credential now exists on their account and on disk, so it never reaches their revocation checklist. Disclosure at exit, not a mid-run question, so the one-authorization-moment contract holds.
+What remains web-only, ever: the paid Apple Developer Program membership purchase itself (a precondition, not a release step) and, for PAID apps only, the one-time Paid Apps agreement with banking and tax — offer the agentic-browser drive per the Third-Party Web Actions contract (earlier in this skill) before any manual checklist for those. A free app needs no browser at any point. After submission, report that App Review typically answers within a day or two and close the run; review outcome is not a gate this workflow can hold open. In that SAME closing report, disclose the durable credential the release created — one line, once per run: "This created an App Store Connect API key (`gstack-upload`, scoped to this app) that persists for future releases; revoke it anytime at App Store Connect → Users and Access → Integrations, or delete `~/.gstack/apple/api-key.json` locally." This is the deliberate exception to the mid-run no-credential-talk rule in this adapter's opening section: the user is otherwise never told a standing credential now exists on their account and on disk, so it never reaches their revocation checklist. Disclosure at exit, not a mid-run question, so the one-authorization-moment contract holds.